✨ Proposal: Specify first level of all JAPI responses about libjapi

[fraunhofer-iis-bot]

In GitLab by @fraunhofer-iis-anon on Jul 8, 2019, 17:52

I suggest ssl-certs to secure communication. It's not necessary, to change the protocol. And it secures other aspects like integrity(which would still be a vulnerability even with the changes) etc. of the messages, too.

[fraunhofer-iis-bot]

In GitLab by @jannismain on Jul 10, 2019, 07:47

AFAIK, SSL certs only verify the server is who he says he is, which makes Man-in-the-Middle attacks harder to execute. Transport security is a valid point and important, as soon as libjapi connects to the WWW, but the issue with he spec I described above, is not limited to MitM vulnerability.

I was rather talking about the general ability for libjapi push-services / request handlers to send packages, that are indistinguishable from libjapi-internal packages.

Introducing hierarchy in the response package data layout would make this an impossibility, which results in...

• a better-defined API (as first layer of response packages would be guaranteed)
• easier client-side parsers
• less chance of bugs due to naming conflicts

[fraunhofer-iis-bot]

In GitLab by @cstender on Jul 11, 2019, 13:15

Yes, SSL is a completely different story. TLS would be is interesting but can also be provided by the WebServer Proxy. So this is low prio atm.

After talking with Thomas we think that it makes sense to implement your proposed format with some minor modifications.

1. Instead of value we would recommend the keyword data.

2. It should be discussed if we really want the success key in the first json hierarchy level. IMO this is user content and should be part of the user data blob.

Comments? Further suggestions?

[fraunhofer-iis-bot]

In GitLab by @cstender on Aug 16, 2019, 15:48

closed